Hacking Hardware

1. Hacking Hardware Ch 9

2. Getting in the Door

3. Normal Key • Link Ch 920 • (At bottom of my CNIT 124 page)

4. Bump Key • Every key pin falls to its lowest point • The key is hit with a screwdriver to create mechanical shocks • The key pins move up and briefly pass through the shear line • The lock can be opened at the instant the key pins align on the shear line

5. Results of Bump Key Use • A experienced bumper can open the lock as quickly as a person with the correct key • Bumping does not damage the lock • Unless it is done many times, or clumsily • Bumping leaves no evidence behind

6. Even Medeco locks used in the White House can be bumped • Link Ch 921

7. Bump Key Countermeasures • Some locks (like Medeco) are designed to make bumping difficult • They use a sidebar and angled pins to make normal picking and bumping ineffective • Don't trust their claims too far • Don't rely solely on locks: use two-factor authentication • PIN keypad • Fingerprint • Security guard • etc.

8. Cloning Access Cards • Two Varieties • Magnetic stripe cards • RFID (Radio Frequency Identification) cards

9. Magstripe Cards • ISO Standards specify three tracks of data • There are various standards, but usually no encryption is used • Link Ch 922

10. Magstripe Card Reader/Writer • USB connector • About $35o • Link Ch 923

11. Magnetic-Stripe Card Explorer • Software • Link Ch924 for more images

12. Hacking RFID Cards • RFID cards use radio signals instead of magnetism • Now required in passports • Data can be read at a distance, and is usually unencrypted

13. Cloning Passports • $250 in equipment • Can steal passport data from a moving car • Link Ch 925

14. MiFare Classic • Mifare is most widely deployed brand of secure RFID chips • Dutch researchers found weaknesses have been found in its proprietary encryption in 2008 • Don't roll your own crypto! • Links Ch 926 & 927

15. Boston Subway Hack • The Massachusetts Bay Transportation Authority claims that they added proprietary encryption to make their MiFare Classic cards secure • But Ron Rivest's students from MIT hacked into it anyway • Link Ch 928

16. Countermeasures for Cloning Access Cards • We are at the mercy of card vendors • Newer cards have a full challenge-response algorithm • Resists cloning and replay attacks • Some use open algorithms, others are proprietary

17. Hacking Devices

18. ATA Interfaces for Hard Drives • Two kinds of ATA (AT Attachment ) interfaces are used • PATA (Parallel ATA) • IDE is now called PATA • SATA (Serial ATA) • Newer and faster than PATA

19. ATA Security • Requires a password to access the hard disk • Virtually every hard drive made since 2000 has this feature • It is part of the ATA specification, and thus not specific to any brand or device. • Does not encrypt the disk, but prevents access

20. ATA Password Virus • ATA Security is used on Microsoft Xbox hard drives and laptops • BUT desktop machines' BIOS is often unaware of ATA security • An attacker could turn on ATA security, and effectively destroy a hard drive, or hold it for ransom • The machine won't boot, and no BIOS command can help • This is only a theoretical attack at the moment

21. Bypassing ATA Passwords • Hot Swap • With an unlocked drive plugged in, enter the BIOS and navigate to the menu that allows you to set a HDD Password • Plug in the locked drive and reset the password • Use factory default master password • Not easy to find • Some examples given in 2600 magazine vol 26 #1

22. Bypassing ATA Passwords • Vogon Password Cracker POD • Changes the password from a simple GUI • Allows law enforcement to image the drive, then restore the original password, so the owner never knows anything has happened • Works by accessing the drive service area • A special area on a disk used for firmware, geometry information, etc. • Inaccessible to the user

23. ATA Security Sources • Hacking Exposed 6th Ed. • Links Ch 929 - 931 • 2600 Magazine

24. ATA Password Bypass Countermeasure • Don't trust ATA Security • Encrypt the drive with Bitlocker, TrueCrypt, PGP, etc.

25. iClicker Questions

26. Which statement is not true? • Bump keys can be made without any special equipment • An expert can find marks inside a lock that shows that a bump key has been used • Skilled bumpers can open a lock quickly • Amateurs can easily learn to use bump keys • Almost every lock in use is vulnerable to bump keys 1 of 3

27. Which statement is not true? • Magstripe cards usually don't use encryption • RFID cards usually don't use encryption • Magstripe cards can be read from several yards away • RFID cards cards can be read from several yards away • Magstripe cards can hold three tracks of data 2 of 3

28. Which statement is not true? • ATA Security encrypts the data on the hard disk • All modern hard drives support ATA Security • Many modern BIOS chips don't support ATA Security • ATA Security can lock the user out of a hard drive • ATA Security is easily bypassed by law enforcement forensic investigators 3 of 3

29. U3 Drives

30. U3: Software on a Flash Drive • Carry your data and your applications in your pocket! • It’s like a tiny laptop!

31. U3 Launchpad • Just plug it in, and the Launchpad appears • Run your applications on anyone’s machine • Take all data away with you

32. How U3 Works • The U3 drive appearsas two devices inMy Computer • A “Removable Disk” • A hidden CD drive named “U3” • The CD contains software that automatically runs on computers that have Autorun enabled • For more details, see http://www.everythingusb.com/u3.html

33. Hak9’s PocketKnife

34. Software On The Disk Partition • PocketKnife is a suite of powerful hacking tools that lives on the disk partition of the U3 drive • Just like other applications

35. U3 PocketKnife • Steal passwords • Product keys • Steal files • Kill antivirus software • Turn off theFirewall • And more… • For details seehttp://wapurl.co.uk/?719WZ2T

36. Custom Launchpad

37. Customizing U3 • You can create a custom file to be executed when a U3 drive is plugged in

38. Automatically Run PocketKnife • The custom U3 launcher runs PocketKnife • So all those things are stolen and put on the flash drive

39. Defense

40. Military Bans USB Thumb Drives

41. Immediate Risk Reduction • Block all USB devices in Group Policy • Disable AutoRun • Glue USB ports shut

42. Better Solution: IEEE 1667 • Standard Protocol for Authentication in Host Attachments of Transient Storage Devices • USB devices can be signed and authenticates, so only authorized devices are allowed • Will be implemented in Windows 7 • See http://wapurl.co.uk/?QXASJBK

43. Default Configurations Pre-0wned

44. ASUS Eee PC Rooted Out of the Box • The Eee PC 701 shipped with Xandros Linux • The Samba file-sharing service was on by default • It was a vulnerable version, easily rooted by Metasploit Easy to learn, Easy to work, Easy to root • Link Ch 933

45. Default Passwords • Many devices ship with default passwords that are often left unchanged • Especially routers (see link Ch 934)

46. ATM Passwords • In 2008, these men used default passwords to reprogram ATM machines to hand out $20 bills like they were $1 bills • Link Ch 936

47. Bluetooth Attacks • Bluetooth supports encryption, but it's off by default, and the password is 0000 by default • Link Ch 935

48. Reverse Engineering Hardware We will skip this section

49. iClicker Questions

50. Which statement is not true? • A U3 device appears to be two hard disk devices in My Computer • The U3 Launchpad appears automatically if AutoRun is enabled • U3 malware can turn off antivirus software • The user can install applications on the U3 drive without local Administrator privileges • U3 drives protect you because all your cookies and other temporary files stay on the U3 system 1 of 4